
cnt= 20000

from stix.core import STIXPackage
from stix.indicator import Indicator
from stix.indicator import Indicator, CompositeIndicatorExpression
from cybox.objects.uri_object import URI



pkg2 = STIXPackage()
pkg2.title="Example of Indicator Composition for a one of many indicator composition"

# create container indicator
watchlistind = Indicator()
watchlistind.add_indicator_type("URL Watchlist")
watchlistind.description = "This Indicator specifies a pattern where any one or more of a set of URL are observed."
# watchlistind.add_indicated_ttp(TTP(idref=c2_ttp.id_))
# Create composite expression
watchlistind.composite_indicator_expression = CompositeIndicatorExpression()
watchlistind.composite_indicator_expression.operator = "OR"

for i in xrange(cnt):
    new_ind = Indicator()
    new_ind.description = "This Indicator specifies a pattern where one specific IP address is observed"

    url = URI()
    url.value = 'http://baidu{}.com'.format(i)
    url.type_ =  URI.TYPE_URL
    url.value.condition = "Equals"
    new_ind.add_observable(url)
    # new_ind.add_indicated_ttp(TTP(idref=c2_ttp.id_))
    watchlistind.composite_indicator_expression.append(new_ind)

pkg2.add_indicator(watchlistind)
print pkg2.to_xml()

